@oneuptime/common 13.0.7 → 13.0.8

package/build/dist/Server/API/StatusPageAPI.js

@@ -36,11 +36,13 @@ import StatusPageService, { Service as StatusPageServiceType, } from "../Service
 import StatusPageSsoService from "../Services/StatusPageSsoService";
 import StatusPageOidcService from "../Services/StatusPageOidcService";
 import StatusPageSubscriberService from "../Services/StatusPageSubscriberService";
+import ModelPermission from "../Types/Database/Permissions/Index";
 import QueryHelper from "../Types/Database/QueryHelper";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import { SEARCH_ENGINE_INDEXING_FLAG_NAME, isSearchEngineIndexingEnabled, } from "../../Types/StatusPage/SearchEngineIndexing";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import ArrayUtil from "../../Utils/Array";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
@@ -49,6 +51,7 @@ import OneUptimeDate from "../../Types/Date";
 import Email from "../../Types/Email";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import JSONFunctions from "../../Types/JSONFunctions";
 import ObjectID from "../../Types/ObjectID";
@@ -136,11 +139,44 @@ class StatusPageAPI extends BaseAPI {
         this.overviewResponseCache.clear();
         this.overviewResponseInFlight.clear();
     }
+    /*
+     * Holding one of StatusPage's update roles is not the same as being allowed
+     * to update a given page: team block rows, label-restricted grants and
+     * Owned-scoped grants all narrow it. Apply the checks a CRUD update of this
+     * page would run - block and label rules against the loaded page, then the
+     * query narrowing (tenant, labels, Owned scope) - and require the page to
+     * survive them. `statusPage` must have been loaded with its labels.
+     */
+    static async assertCanUpdateStatusPage(data) {
+        await ModelPermission.checkUpdatePermissionByModel({
+            modelType: StatusPage,
+            fetchModelWithAccessControlIds: async () => {
+                return data.statusPage;
+            },
+            props: data.props,
+        });
+        const permittedQuery = await ModelPermission.checkUpdateQueryPermissions(StatusPage, {
+            _id: data.statusPage.id,
+            projectId: data.projectId,
+        }, {}, data.props);
+        const permittedStatusPage = await StatusPageService.findOneBy({
+            query: permittedQuery,
+            select: {
+                _id: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!permittedStatusPage) {
+            throw new NotAuthorizedException("You do not have permission to send this status page's report.");
+        }
+    }
     constructor() {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9;
         super(StatusPage, StatusPageService);
         // get title, description of the page.  This is used for SEO.
-        this.router.get(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/seo/:statusPageIdOrDomain`, UserMiddleware.getUserMiddleware, async (req, res) => {
+        this.router.get(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/seo/:statusPageIdOrDomain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res) => {
             var _a;
             const statusPageIdOrDomain = req.params["statusPageIdOrDomain"];
             // Shares the service resolver's custom-domain -> statusPageId cache.
@@ -279,7 +315,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_e = new this.entityType()
-            .getCrudApiPath()) === null || _e === void 0 ? void 0 : _e.toString()}/incident-public-note/attachment/:statusPageId/:incidentId/:noteId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _e === void 0 ? void 0 : _e.toString()}/incident-public-note/attachment/:statusPageId/:incidentId/:noteId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getIncidentPublicNoteAttachment(req, res);
             }
@@ -288,7 +324,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_f = new this.entityType()
-            .getCrudApiPath()) === null || _f === void 0 ? void 0 : _f.toString()}/incident-episode-public-note/attachment/:statusPageId/:episodeId/:noteId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _f === void 0 ? void 0 : _f.toString()}/incident-episode-public-note/attachment/:statusPageId/:episodeId/:noteId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getIncidentEpisodePublicNoteAttachment(req, res);
             }
@@ -297,7 +333,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_g = new this.entityType()
-            .getCrudApiPath()) === null || _g === void 0 ? void 0 : _g.toString()}/incident/postmortem/attachment/:statusPageId/:incidentId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _g === void 0 ? void 0 : _g.toString()}/incident/postmortem/attachment/:statusPageId/:incidentId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getIncidentPostmortemAttachment(req, res);
             }
@@ -306,7 +342,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_h = new this.entityType()
-            .getCrudApiPath()) === null || _h === void 0 ? void 0 : _h.toString()}/scheduled-maintenance-public-note/attachment/:statusPageId/:scheduledMaintenanceId/:noteId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _h === void 0 ? void 0 : _h.toString()}/scheduled-maintenance-public-note/attachment/:statusPageId/:scheduledMaintenanceId/:noteId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getScheduledMaintenancePublicNoteAttachment(req, res);
             }
@@ -315,7 +351,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_j = new this.entityType()
-            .getCrudApiPath()) === null || _j === void 0 ? void 0 : _j.toString()}/status-page-announcement/attachment/:statusPageId/:announcementId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _j === void 0 ? void 0 : _j.toString()}/status-page-announcement/attachment/:statusPageId/:announcementId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getStatusPageAnnouncementAttachment(req, res);
             }
@@ -530,10 +566,54 @@ class StatusPageAPI extends BaseAPI {
             }
             return Response.sendTextResponse(req, res, challenge.challenge);
         });
-        this.router.post(`${(_p = new this.entityType().getCrudApiPath()) === null || _p === void 0 ? void 0 : _p.toString()}/test-email-report`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        /*
+         * Sends the status page's report to an address the caller chooses, so it
+         * is gated like editing the status page: an authenticated member of the
+         * project that owns it who could update this particular page.
+         */
+        this.router.post(`${(_p = new this.entityType().getCrudApiPath()) === null || _p === void 0 ? void 0 : _p.toString()}/test-email-report`, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
             try {
+                /*
+                 * This route acts on one page in one project, and the permission
+                 * checks below must be evaluated for that single tenant, so the
+                 * request is never treated as multi-tenant.
+                 */
+                const props = Object.assign(Object.assign({}, (await CommonAPI.getDatabaseCommonInteractionProps(req))), { isMultiTenantRequest: false });
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+                CommonAPI.assertPermittedInProject({
+                    databaseProps: props,
+                    allowedPermissions: new StatusPage().getUpdatePermissions(),
+                    errorMessage: "You do not have permission to send this status page's report.",
+                });
+                if (!req.body["statusPageId"] ||
+                    !ObjectID.isValidUUID(req.body["statusPageId"].toString())) {
+                    throw new BadDataException("A valid statusPageId is required.");
+                }
                 const email = new Email(req.body["email"]);
                 const statusPageId = new ObjectID(req.body["statusPageId"].toString());
+                const statusPage = await StatusPageService.findOneById({
+                    id: statusPageId,
+                    select: {
+                        _id: true,
+                        projectId: true,
+                        labels: {
+                            _id: true,
+                            name: true,
+                        },
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                CommonAPI.assertResourceBelongsToProject({
+                    resourceProjectId: statusPage === null || statusPage === void 0 ? void 0 : statusPage.projectId,
+                    projectId,
+                });
+                await StatusPageAPI.assertCanUpdateStatusPage({
+                    statusPage: statusPage,
+                    projectId,
+                    props,
+                });
                 await StatusPageService.sendEmailReport({
                     email: email,
                     statusPageId,
@@ -544,7 +624,7 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_q = new this.entityType().getCrudApiPath()) === null || _q === void 0 ? void 0 : _q.toString()}/domain`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_q = new this.entityType().getCrudApiPath()) === null || _q === void 0 ? void 0 : _q.toString()}/domain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 if (!req.body["domain"]) {
                     throw new BadDataException("domain is required in request body");
@@ -577,7 +657,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_r = new this.entityType()
-            .getCrudApiPath()) === null || _r === void 0 ? void 0 : _r.toString()}/master-page/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _r === void 0 ? void 0 : _r.toString()}/master-page/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const statusPageIdParam = req.params["statusPageId"];
                 ObjectID.validateUUID(statusPageIdParam);
@@ -729,7 +809,7 @@ class StatusPageAPI extends BaseAPI {
          * PublicDashboardRateLimit for the budget and why it fails closed.
          */
         this.router.post(`${(_s = new this.entityType()
-            .getCrudApiPath()) === null || _s === void 0 ? void 0 : _s.toString()}/master-password/:statusPageId`, PublicDashboardRateLimit.getMiddleware(PublicDashboardRateLimitBucket.StatusPageMasterPassword), UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _s === void 0 ? void 0 : _s.toString()}/master-password/:statusPageId`, PublicDashboardRateLimit.getMiddleware(PublicDashboardRateLimitBucket.StatusPageMasterPassword), UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 if (!req.params["statusPageId"]) {
                     throw new BadDataException("Status Page ID not found");
@@ -780,7 +860,7 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_t = new this.entityType().getCrudApiPath()) === null || _t === void 0 ? void 0 : _t.toString()}/sso/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_t = new this.entityType().getCrudApiPath()) === null || _t === void 0 ? void 0 : _t.toString()}/sso/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = new ObjectID(req.params["statusPageId"]);
                 const sso = await StatusPageSsoService.findBy({
@@ -806,7 +886,7 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_u = new this.entityType().getCrudApiPath()) === null || _u === void 0 ? void 0 : _u.toString()}/oidc/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_u = new this.entityType().getCrudApiPath()) === null || _u === void 0 ? void 0 : _u.toString()}/oidc/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = new ObjectID(req.params["statusPageId"]);
                 const oidc = await StatusPageOidcService.findBy({
@@ -833,7 +913,7 @@ class StatusPageAPI extends BaseAPI {
         });
         // Get all status page resources for subscriber to subscribe to.
         this.router.post(`${(_v = new this.entityType()
-            .getCrudApiPath()) === null || _v === void 0 ? void 0 : _v.toString()}/resources/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _v === void 0 ? void 0 : _v.toString()}/resources/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const statusPageId = new ObjectID(req.params["statusPageId"]);
                 await this.checkHasReadAccess({
@@ -867,7 +947,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_w = new this.entityType()
-            .getCrudApiPath()) === null || _w === void 0 ? void 0 : _w.toString()}/uptime/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _w === void 0 ? void 0 : _w.toString()}/uptime/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             var _a, _b;
             try {
                 // This reosurce ID can be of a status page resource OR a status page group.
@@ -1151,15 +1231,15 @@ class StatusPageAPI extends BaseAPI {
         };
         const overviewApiPath = `${(_x = new this.entityType()
             .getCrudApiPath()) === null || _x === void 0 ? void 0 : _x.toString()}/overview/:statusPageIdOrDomain`;
-        this.router.post(overviewApiPath, UserMiddleware.getUserMiddleware, overviewHandler);
+        this.router.post(overviewApiPath, UserMiddleware.getPublicRouteUserMiddleware, overviewHandler);
         /*
          * GET variant of the overview endpoint. Same middleware and same handler
          * as the POST route above — private status pages are rejected for
          * unauthenticated callers exactly as they are on POST.
          */
-        this.router.get(overviewApiPath, UserMiddleware.getUserMiddleware, overviewHandler);
+        this.router.get(overviewApiPath, UserMiddleware.getPublicRouteUserMiddleware, overviewHandler);
         this.router.put(`${(_y = new this.entityType()
-            .getCrudApiPath()) === null || _y === void 0 ? void 0 : _y.toString()}/update-subscription/:statusPageId/:subscriberId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _y === void 0 ? void 0 : _y.toString()}/update-subscription/:statusPageId/:subscriberId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.subscribeToStatusPage(req);
                 return Response.sendEmptySuccessResponse(req, res);
@@ -1169,7 +1249,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_z = new this.entityType()
-            .getCrudApiPath()) === null || _z === void 0 ? void 0 : _z.toString()}/get-subscription/:statusPageId/:subscriberId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _z === void 0 ? void 0 : _z.toString()}/get-subscription/:statusPageId/:subscriberId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const subscriber = await this.getSubscriber(req);
                 return Response.sendEntityResponse(req, res, subscriber, StatusPageSubscriber);
@@ -1179,7 +1259,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_0 = new this.entityType()
-            .getCrudApiPath()) === null || _0 === void 0 ? void 0 : _0.toString()}/subscribe/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _0 === void 0 ? void 0 : _0.toString()}/subscribe/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.subscribeToStatusPage(req);
                 return Response.sendEmptySuccessResponse(req, res);
@@ -1189,7 +1269,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_1 = new this.entityType()
-            .getCrudApiPath()) === null || _1 === void 0 ? void 0 : _1.toString()}/manage-subscription/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _1 === void 0 ? void 0 : _1.toString()}/manage-subscription/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.manageExistingSubscription(req);
                 return Response.sendEmptySuccessResponse(req, res);
@@ -1216,8 +1296,8 @@ class StatusPageAPI extends BaseAPI {
         };
         const incidentsListApiPath = `${(_2 = new this.entityType()
             .getCrudApiPath()) === null || _2 === void 0 ? void 0 : _2.toString()}/incidents/:statusPageIdOrDomain`;
-        this.router.post(incidentsListApiPath, UserMiddleware.getUserMiddleware, incidentsListHandler);
-        this.router.get(incidentsListApiPath, UserMiddleware.getUserMiddleware, incidentsListHandler);
+        this.router.post(incidentsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, incidentsListHandler);
+        this.router.get(incidentsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, incidentsListHandler);
         /*
          * Shared handler for the scheduled maintenance events list endpoint.
          * Registered for both POST and GET (same auth path). It does not read
@@ -1237,8 +1317,8 @@ class StatusPageAPI extends BaseAPI {
         };
         const scheduledMaintenanceEventsListApiPath = `${(_3 = new this.entityType()
             .getCrudApiPath()) === null || _3 === void 0 ? void 0 : _3.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain`;
-        this.router.post(scheduledMaintenanceEventsListApiPath, UserMiddleware.getUserMiddleware, scheduledMaintenanceEventsListHandler);
-        this.router.get(scheduledMaintenanceEventsListApiPath, UserMiddleware.getUserMiddleware, scheduledMaintenanceEventsListHandler);
+        this.router.post(scheduledMaintenanceEventsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, scheduledMaintenanceEventsListHandler);
+        this.router.get(scheduledMaintenanceEventsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, scheduledMaintenanceEventsListHandler);
         /*
          * Shared handler for the announcements list endpoint. Registered for
          * both POST and GET (same auth path). It does not read req.body.
@@ -1257,10 +1337,10 @@ class StatusPageAPI extends BaseAPI {
         };
         const announcementsListApiPath = `${(_4 = new this.entityType()
             .getCrudApiPath()) === null || _4 === void 0 ? void 0 : _4.toString()}/announcements/:statusPageIdOrDomain`;
-        this.router.post(announcementsListApiPath, UserMiddleware.getUserMiddleware, announcementsListHandler);
-        this.router.get(announcementsListApiPath, UserMiddleware.getUserMiddleware, announcementsListHandler);
+        this.router.post(announcementsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, announcementsListHandler);
+        this.router.get(announcementsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, announcementsListHandler);
         this.router.post(`${(_5 = new this.entityType()
-            .getCrudApiPath()) === null || _5 === void 0 ? void 0 : _5.toString()}/incidents/:statusPageIdOrDomain/:incidentId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _5 === void 0 ? void 0 : _5.toString()}/incidents/:statusPageIdOrDomain/:incidentId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const incidentId = new ObjectID(req.params["incidentId"]);
@@ -1272,7 +1352,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_6 = new this.entityType()
-            .getCrudApiPath()) === null || _6 === void 0 ? void 0 : _6.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain/:scheduledMaintenanceId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _6 === void 0 ? void 0 : _6.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain/:scheduledMaintenanceId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const scheduledMaintenanceId = new ObjectID(req.params["scheduledMaintenanceId"]);
@@ -1284,7 +1364,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_7 = new this.entityType()
-            .getCrudApiPath()) === null || _7 === void 0 ? void 0 : _7.toString()}/announcements/:statusPageIdOrDomain/:announcementId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _7 === void 0 ? void 0 : _7.toString()}/announcements/:statusPageIdOrDomain/:announcementId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const announcementId = new ObjectID(req.params["announcementId"]);
@@ -1297,7 +1377,7 @@ class StatusPageAPI extends BaseAPI {
         });
         // Episodes endpoints
         this.router.post(`${(_8 = new this.entityType()
-            .getCrudApiPath()) === null || _8 === void 0 ? void 0 : _8.toString()}/episodes/:statusPageIdOrDomain`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _8 === void 0 ? void 0 : _8.toString()}/episodes/:statusPageIdOrDomain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const response = await this.getEpisodes(objectId, null, req);
@@ -1308,7 +1388,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_9 = new this.entityType()
-            .getCrudApiPath()) === null || _9 === void 0 ? void 0 : _9.toString()}/episodes/:statusPageIdOrDomain/:episodeId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _9 === void 0 ? void 0 : _9.toString()}/episodes/:statusPageIdOrDomain/:episodeId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const episodeId = new ObjectID(req.params["episodeId"]);
@@ -2258,6 +2338,18 @@ class StatusPageAPI extends BaseAPI {
         }
         return statusPageSubscriber;
     }
+    serializeIncidentsForStatusPage(incidents) {
+        return incidents.map((incident) => {
+            const incidentJson = BaseModel.toJSON(incident, Incident);
+            // Enforce postmortem visibility before sending or caching status-page JSON.
+            if (incident.showPostmortemOnStatusPage !== true) {
+                delete incidentJson["postmortemNote"];
+                delete incidentJson["postmortemPostedAt"];
+                delete incidentJson["postmortemAttachments"];
+            }
+            return incidentJson;
+        });
+    }
     async getIncidents(statusPageId, incidentId, req) {
         await this.checkHasReadAccess({
             statusPageId: statusPageId,
@@ -2465,7 +2557,7 @@ class StatusPageAPI extends BaseAPI {
         const response = {
             incidentPublicNotes: BaseModel.toJSONArray(incidentPublicNotes, IncidentPublicNote),
             incidentStates: BaseModel.toJSONArray(incidentStates, IncidentState),
-            incidents: BaseModel.toJSONArray(incidents, Incident),
+            incidents: this.serializeIncidentsForStatusPage(incidents),
             statusPageResources: BaseModel.toJSONArray(statusPageResources, StatusPageResource),
             incidentStateTimelines: BaseModel.toJSONArray(incidentStateTimelines, IncidentStateTimeline),
             monitorsInGroup: JSONFunctions.serialize(monitorsInGroup),
@@ -3745,7 +3837,7 @@ class StatusPageAPI extends BaseAPI {
             scheduledMaintenanceEvents: BaseModel.toJSONArray(scheduledMaintenanceEvents, ScheduledMaintenance),
             activeAnnouncements: BaseModel.toJSONArray(activeAnnouncements, StatusPageAnnouncement),
             incidentPublicNotes: BaseModel.toJSONArray(incidentPublicNotes, IncidentPublicNote),
-            activeIncidents: BaseModel.toJSONArray(activeIncidents, Incident),
+            activeIncidents: this.serializeIncidentsForStatusPage(activeIncidents),
             activeEpisodes: activeEpisodesJson,
             episodePublicNotes: BaseModel.toJSONArray(episodePublicNotes, IncidentEpisodePublicNote),
             episodeStateTimelines: BaseModel.toJSONArray(episodeStateTimelines, IncidentEpisodeStateTimeline),